topic IOS zone-based firewall without protocol inspection in Network Security https://community.cisco.com/t5/network-security/ios-zone-based-firewall-without-protocol-inspection/m-p/1340370#M811635 <P>Hi, I defined about 20 zone-pair between 10 zone/vlan in a 2800 router.</P><P>Zone-based firewall runs very well but I'd like to avoid specific protocol inspection (now it inspects evry protocols) and to realize a simple L4 firewall, based on the class access-lists.</P><P>How to ?</P><P>thanks</P> Mon, 11 Mar 2019 16:01:46 GMT r.spiandorello 2019-03-11T16:01:46Z IOS zone-based firewall without protocol inspection https://community.cisco.com/t5/network-security/ios-zone-based-firewall-without-protocol-inspection/m-p/1340370#M811635 <P>Hi, I defined about 20 zone-pair between 10 zone/vlan in a 2800 router.</P><P>Zone-based firewall runs very well but I'd like to avoid specific protocol inspection (now it inspects evry protocols) and to realize a simple L4 firewall, based on the class access-lists.</P><P>How to ?</P><P>thanks</P> Mon, 11 Mar 2019 16:01:46 GMT https://community.cisco.com/t5/network-security/ios-zone-based-firewall-without-protocol-inspection/m-p/1340370#M811635 r.spiandorello 2019-03-11T16:01:46Z Re: IOS zone-based firewall without protocol inspection https://community.cisco.com/t5/network-security/ios-zone-based-firewall-without-protocol-inspection/m-p/1340371#M811651 <HTML><HEAD></HEAD><BODY><P>You can combine the match access-group filter with Layer 4 specific filters like "match protocol tcp/udp/icmp" for Layer4 only inspection.For non-transport protocol like GRE, you need to have a "match access-list" with pass action.</P></BODY></HTML> Tue, 04 Aug 2009 04:08:31 GMT https://community.cisco.com/t5/network-security/ios-zone-based-firewall-without-protocol-inspection/m-p/1340371#M811651 sadsiddi 2009-08-04T04:08:31Z